Fix Code Queue runner skills delivery

This commit is contained in:
Codex
2026-05-23 19:56:01 +00:00
parent fccd25b31e
commit 9b164c1781
9 changed files with 402 additions and 8 deletions
@@ -1,4 +1,5 @@
import { spawnSync } from "node:child_process";
import { readFileSync } from "node:fs";
type JsonRecord = Record<string, unknown>;
@@ -153,6 +154,16 @@ assertCondition(prodArtifactDryRun.requiresSupervisorApproval === true, "artifac
assertCondition(asRecord(prodArtifactDryRun.selfBootstrapGuard, "prod artifact selfBootstrapGuard").selfBootstrapBlocked === true, "artifact-registry prod code-queue should expose self-bootstrap guard", prodArtifactDryRun);
assertCondition(JSON.stringify(prodArtifactDryRun).includes("production artifact deploy") && JSON.stringify(prodArtifactDryRun).includes("active task"), "artifact-registry prod code-queue should explain prod deploy and active-task boundaries", prodArtifactDryRun);
const ciSource = readFileSync("scripts/src/ci.ts", "utf8");
assertCondition(ciSource.includes('type CiPublishTransport = "auto" | "tekton" | "direct-docker"'), "ci publish-user-service should expose an explicit transport selector");
assertCondition(ciSource.includes('options.transport === "direct-docker"'), "ci publish-user-service should support direct-docker artifact publish");
assertCondition(ciSource.includes('options.transport === "auto" && options.serviceId === "code-queue"'), "auto transport should select direct-docker for Code Queue artifacts");
assertCondition(ciSource.includes("dependsOnLocalUnideskDatabase: false"), "direct-docker publish must not depend on local unidesk-database dispatch");
assertCondition(ciSource.includes("CODE_QUEUE_BASE_IMAGE=unidesk-code-queue:d601"), "direct-docker Code Queue publish must use the warmed D601 base image");
assertCondition(ciSource.includes("code-queue-base-image-missing"), "direct-docker Code Queue publish should fail fast when the warmed base image is missing");
assertCondition(ciSource.includes("no deploy apply, no rollout, no Code Queue restart, no active task mutation"), "direct-docker publish boundary should forbid runtime mutation");
assertCondition(ciSource.includes("repo-owned Docker artifact publish without backend-core/database dispatch"), "ci help should describe the repo-owned direct-docker delivery path");
process.stdout.write(`${JSON.stringify({
ok: true,
checks: [
@@ -161,5 +172,6 @@ process.stdout.write(`${JSON.stringify({
"prod Code Queue plan is unsupported and exposes no runtime deploy target",
"prod Code Queue boundary forbids self-deploy, prod mutation, interrupt and cancel actions",
"artifact-registry dev dry-run is non-mutating while prod remains unsupported",
"ci publish-user-service exposes direct-docker Code Queue artifact publish without local database dispatch",
],
}, null, 2)}\n`);